Elevated Command non-functioning

Try3: Yes after creating the new accounts they performed the same as the existing ones. Appreciate all you support and help but it is time for a fresh install.

Is Windows on G:?

This administrator is enabled: C:\Users\rhstu




Bitdefender: enabled

Acronis True Image: enabled

McAfee

No: Windows is on C: the G: should have been a thumbdrive (The app you suggested was lauched from the thumbdrive)

Please rerun from Windows.

And see if the computer will run V2 from normal boot or safe mode:

Zbook: I think I ran this as instructed from my offending PC's Download directory. Attached is the output.

Windows 11 Pro
Version: 10.0.26200


1) Was an in place upgrade repair performed yesterday?


You must be signed in as an administrator to perform a repair install of Windows 11.





2) See if uninstalling these software makes a difference:







Bitdefender Agent 27.1.1.28 Bitdefender
Bitdefender Total Security 26.0.30.102 Bitdefender

AVG Update Helper 1.8.1188.1 AVG Technologies 20220101

Driver Booster 13 13.2.0 IObit 20260114

IObit Malware Fighter 13 13.1.0.1617 IObit 20260109
IObit Software Updater 8.3.0.12 IObit 20260117
IObit Uninstaller 15 15.2.0.2 IObit 20251223

McAfee Safe Connect 2.13 McAfee, LLC.
McAfee Safe Connect 2.13 McAfee, LLC. 20211023




3) Add WMIC:





4) If possible run these commands:

reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList"

wmic useraccount get name, sid

whoami /user



Administrator (S-1-5-21-3500871638-1745993587-2605281543-500 - Administrator - Disabled) => C:\Users\Administrator
DefaultAccount (S-1-5-21-3500871638-1745993587-2605281543-503 - Limited - Disabled)
Guest (S-1-5-21-3500871638-1745993587-2605281543-501 - Limited - Disabled)
Guest_one (S-1-5-21-3500871638-1745993587-2605281543-1005 - Limited - Enabled) => C:\Users\Guest_one
rhstu (S-1-5-21-3500871638-1745993587-2605281543-1001 - Administrator - Enabled) => C:\Users\rhstu
Rich1 (S-1-5-21-3500871638-1745993587-2605281543-1011 - Limited - Enabled) => C:\Users\Rich1
rich2 (S-1-5-21-3500871638-1745993587-2605281543-1012 - Limited - Enabled) => C:\Users\rich2
tex-m (S-1-5-21-3500871638-1745993587-2605281543-1002 - Limited - Enabled) => C:\Users\tex-m
WDAGUtilityAccount (S-1-5-21-3500871638-1745993587-2605281543-504 - Limited - Disabled)
WsiAccount (S-1-5-21-3500871638-1745993587-2605281543-1010 - Limited - Disabled) => C:\Users\WsiAccount

These were AI suggestions for a blocked administrative command prompt if uninstalling the above third party software did not fix the block:


Group Policy Editor (Recommended for Pro/Enterprise):
Press Win + R, type gpedit.msc, and hit Enter.
Navigate to: User Configuration > Administrative Templates > System.
Double-click Prevent access to the command prompt.
Set to Disabled or Not Configured.
Click Apply and OK.



Registry Editor (For Home Edition):
Press Win + R, type regedit, and hit Enter.
Navigate to: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System.
Find DisableCMD and set its value to 0. If it doesn't exist, this policy is likely not set via registry.



Command Prompt Fix Command:
Open Run (Win + R), type cmd, and try to run: REG add HKCU\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 0 /f.



Check for Malware:



Sometimes this restriction is caused by viruses; run a full system scan.



If the issue persists, ensure you are logged in with an account that has administrator privileges.

Zbook: RE: #46 Yes a in place upgrade was attempted yesterday with Admin priviledges via the Task Manager Built in command with elevated priviledges (If I executed it correctly). I did this via an ISO file d/l from M/S site and mounted it on the offending PC.
Removed Bitdefender, Drive Booster, Iobit Malware + Software Updater + Uninstaller and McAfee Safe Connect.
Activated WMIC
Ran these commands from Built in (Task Manager) command prompt - elevated:



I still cannot get a elevated command prompt using the taskbar.

Could this be a clue?? Notice the next to last entry: Empty Registry Keys: This is for my account 1-5-21 (data) VID_046D&PID_C548

1) Please post a larger image for post#49.



2) Run Tuneup_plus_log.bat > post a share link






3) Indicate whether administrative command prompt opens in clean boot and safe mode:





4) Try steps from AI in post #47

@rhstubby
Q. do you have malwarebytes installed on your system ?

best of luck Steve ..

rhstubby said:

Could this be a clue??

Click to expand...

No, your problem also exists in other user accounts as you have determined during your tests.
So the contents of your rhstu user profile cannot explain what is wrong with those others.
And there's nothing suspicious in the entries you posted anyway.
I don't know what software you used to make that diagram. If you need to post anything from it again then adjust its column widths before making the screenshot to eliminate the wasted space that is making the diagram bigger and so making the whole thing harder to read [it was getting very blurry by the time I'd zoomed in on it enough to be able to read the data].



I see in your exchanges with zbook that you have now disabled the Built-in Admin [the account with the username Administrator]. That's good. As long as the tests I suggested for that Built-in Admin really were done whilst logged into it.


All the best,
Denis

rhstubby said:

This is for my account 1-5-21 (data)

Click to expand...

I don't understand that "1-5-21 (data)" comment. Why "data"?
Those "empty" lines you posted were for your rhstu user account.


Denis

Zbook: Split the image to enlarge it (entry next to bottom entitled Empty Registry Key (VID_046D$PID_C548. Also Tuneup.log

Effective 1/29/26 I removed all known suspicious software (Bitdefender, Malware Fighter, Drive Booster, Software Updater, Uninstaller, McAfee Safe Connect but never found AVG Update Helper to delete it. (It wasn't in any list with REVO to delete).
With these removed the issue remain.

If possible, attempt to launch each administrative command prompt and administrative PS while in normal boot and in safe mode > post images or share links displaying error messages or codes.

Then please post new frst and addition share links (post #38) into the newest post.

Zbook: I went to ‘SAFE MODE’ and was able to capture an Android photo of the screen. Each window I was able to open shows the source of that window typed into the command line. I opened some via the task bar and some via the Task Manager start a new command which automatically placed me in Admin mode. I then went while in safe mode to try to show you the video of me trying to get a command prompt elevated to Admin. (I believe if I’m in admin already it should NOT offer me an option to go to an elevated command? Correct?) Well, if that is the case then the exact thing is what I’m seeing from my ‘admin / user account’. So has my user account which was manually set to Admin now inherited the attributes of a higher authority (i.e., Microsoft’s authority?). So, in one case I get powershells both starting at System32 but my Cmd prompt starts at rhstu or from the built in task manager from System32.

My other (good) computer does not exhibit these characteristics.

I placed the images (JPG) files and movie MP4 of the screens in SAFE Mode at: Public Folder - Google Drive

I place the video of me seeking a command with elevated privileges as I would do it from a lower-level user (this was ADMIN) so if my assumption is correct whether I’m in Safe Mode or running normal my command prompt will not be elevated (perhaps because it has Microsoft authority already? How can that be??). But then it never goes to the System32 folder where it would normally be executed from when it is an rhstu prompt.

Also I ran the FRST.exe file and renamed the logs with the term SAFE in the title to distinguish them from those run in normal mode.

I just went to my NON-offending (Good PC) and took screen grabs of normal command prompts and Powershell request and requested elevated Cmd and PS windows upon successfully elevating them to Admin. This single composite picture is in my Public folder on Google Drive if you need more evidence I'm not SEEING or imagining THINGS! I typed in how I got each window to appear on the 'good pc'.

The mp4 reported that the computer does not have the codec for viewing with error code 0xc00d5212.

When available post the links from frst.

Revo doesn't always get all the remnants of AV products when uninstalling. Each AV app; has their own Uninstaller. Download MCPR tool for McAfee
Download AvastClear Tool

When you start a Command Prompt or PS as Admin, you may still need to run apps as Admin.

Press the Windows key +X and choose Terminal (Admin) and press Enter.
Copy and Paste or type

DISM /Online /CLEANUP-IMAGE /RestoreHealth and press Enter. Once completed, type
SFC /scannow and press enter.
This will replace any missing or corrupted Windows files.